The ZTunnel proxy must receive and query workload and service information via an xDS server.

At the end of this task ZTunnel should receive control-plane information reflecting created, updated, and removed workload and services. The control-plane information must be adequate to support ZTunnel TLS HBONE proxying, most notable, must include spiffe ID information for success certificate look. The certificate lookup itself is outside the scope of this task.